电商爆款拆解分析助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 1.0.1

Overview

This skill mostly matches its shopping-analysis purpose, but it asks for broader command and file authority than the workflow needs and generates browser-executable HTML from untrusted market data without clear safety controls.

Review this skill before installing. It appears intended to create e-commerce analysis reports, but you should limit or remove Bash if possible, generate reports only when you explicitly ask for them, and treat the HTML output as active content because it can load third-party JavaScript and may include untrusted marketplace text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Note

• Location: assets/report_template.html:458

Finding

Forced Third-Party Branding in Generated Reports

Content

View full analysis

📊 E-commerce Hot Product Analysis Report · Automatically generated by WorkBuddy AI ``` The original template hardcodes the equivalent Chinese-language attribution to “WorkBuddy AI” at this location. ### Technical Analysis The report template unconditionally inserts third-party branding into every generated report. The skill workflow requires the agent to generate its output from this template, so the attribution becomes part of normal task output even when the user did not request it. This is an output-manipulation issue rather than arbitrary code execution. It changes the content delivered by the agent and promotes an external brand independently of the requested e-commerce analysis. ### Attack Path 1. A user requests a hot-product or category analysis. 2. The skill instructs the agent to generate the report from `assets/report_template.html`. 3. The fixed footer is retained during template rendering. 4. The report delivered to the user advertises “WorkBuddy AI” without explicit user consent. ### Impact Assessment The issue affects the integrity and neutrality of generated reports. It can cause misleading attribution, unsolicited promotion, or confusion about which system created the report. It does not provide filesystem access, code execution, credential access, or elevated privileges. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: assets/report_template.html:6

Finding

Unsafe Raw Interpolation into HTML and JavaScript Contexts

Content

View full analysis

{{CATEGORY_NAME}} — 电商爆款拆解分析报告 ``` ```html

🔍 {{CATEGORY_NAME}} — 电商爆款拆解分析报告

``` ```html {{PRODUCT_TABLE_ROWS}} ``` ```html

{{SELLING_POINT_CARDS}}

``` ```html

{{RULE_CARDS}}

``` ```html

{{COMPETITION_INSIGHT}}

``` ```html

{{ACTION_STEPS}}

``` JavaScript execution contexts also contain raw placeholders: ```javascript data: { labels: {{PRICE_LABELS}}, datasets: [{ label: '商品数量', data: {{PRICE_DATA}}, ``` ```javascript data: { labels: {{SALES_LABELS}}, datasets: [{ label: '销量', data: {{SALES_DATA}}, ``` ```javascript data: { labels: {{KEYWORD_TYPE_LABELS}}, datasets: [{ data: {{KEYWORD_TYPE_DATA}}, ``` ```javascript data: { labels: {{STYLE_LABELS}}, datasets: [{ label: '使用率 (%)', data: {{STYLE_DATA}}, ``` ```javascript data: { labels: {{DESIGN_ELEMENT_LABELS}}, datasets: [{ label: '使用频率 (%)', data: {{DESIGN_ELEMENT_DATA}}, ``` ```javascript data: { labels: {{BRAND_LABELS}}, datasets: [{ data: {{BRAND_DATA}}, ``` ### Technical Analysis The template mixes dynamic data with HTML markup and executable JavaScript without defining contextual escaping or sanitization requirements. The affected values can originate from: - User-provided category names. - Product names and promotional text collected from public search results. - Selling points, competitive insights, and action recommendations generated from untrusted source material. - Chart labels and values derived from collected data. HTML-context v ...[truncated 2013 chars]

Remediation

View remediation

` termination. - Prefer placing report data in a non-executable JSON block and parsing it: ```html ``` - Validate all numeric chart values as finite numbers and enforce expected array lengths. - Add a restrictive Content Security Policy that disallows inline scripts where practical. - Add security tests using payloads containing HTML tags, event handlers, quotes, backticks, backslashes, Unicode separators, and `

T08 · Insecure Dependencies

Warning

• Location: assets/report_template.html:7

Finding

Remote JavaScript Dependency Loaded Without Integrity Verification

Content

View full analysis

``` ### Technical Analysis Every generated report loads and executes Chart.js from a third-party CDN at viewing time. Although the dependency version is pinned, the script element has no Subresource Integrity value and no `crossorigin` configuration for SRI validation. Consequently, the browser trusts whatever JavaScript is returned for that URL. The effective executable content is therefore not fully contained in or cryptographically bound to the audited project artifact. Potential compromise points include the package publication account, package registry, CDN infrastructure, DNS resolution, or other elements of the remote supply chain. HTTPS protects transport in normal conditions but does not protect against a legitimate upstream serving modified content. ### Attack Path 1. An attacker compromises an upstream package publication or CDN delivery path. 2. The JavaScript returned from the configured jsDelivr URL is replaced or modified. 3. A user opens a generated report while connected to the network. 4. The browser retrieves the remote script. 5. Because no SRI hash is present, the browser cannot verify that the content matches the audited Chart.js file. 6. The altered script executes in the report's browser context. ### Impact Assessment A compromised dependency can execute arbitrary JavaScript in every report that loads it. The resulting scope is similar to script injection in the report and may include: - Reading and modifying report contents. - Exfiltrating displayed data. - Redirecting users or presenting phishing content. - Performing same-origin actions if the report is hosted on a web application origin. - Tracking report viewers. This issue does not directly gr ...[truncated 108 chars]

Remediation

View remediation

``` - Do not insert a placeholder hash; calculate it from the exact audited file. - Apply a restrictive Content Security Policy that permits scripts only from approved sources and uses hashes or nonces. - Maintain an inventory of bundled and remote dependencies and periodically review them for known vulnerabilities. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary Bash Permission Violates Least Privilege

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is very broad and includes generic shopping and market-analysis phrases such as '市场分析', '商品分析报告', and '什么好卖', which can cause the skill to activate in conversations where the user did not clearly request this specific workflow. Because the skill has WebSearch, WebFetch, Write, and Bash permissions, accidental invocation can lead to unexpected network access and file generation without strong user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill generates an HTML file and explicitly depends on Chart.js via CDN, but the description does not warn users that it will write a local report and reference external third-party resources. This weakens informed consent and can expose users to privacy, supply-chain, or policy risks if fetched data or generated content is opened in a browser and loads remote scripts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The HTML document sets lang="zh-CN", which forces a specific language/locale in the generated report. Under the policy, locale restrictions should either offer user opt-in/choice or be clearly documented as justified for a region-specific tool, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template loads Chart.js directly from a public CDN at render time, which introduces an external script supply-chain dependency into generated reports. If the CDN response is tampered with, blocked, or swapped for a malicious payload, anyone opening the report could execute attacker-controlled JavaScript in their browser.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The note "报告语言：中文为主" sets a default language requirement in natural language, but the skill does not say users can choose another language or opt in to Chinese output. This can violate language/locale policy expectations when no explicit user language preference has been established.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.